feat: Web Push 비활성 운영 설정을 준비한다

VAPID private key를 Compose secret으로 주입하고 Web Push를 기본 비활성으로 전달한다. 활성화 입력과 Compose 모델 검증, 운영 README를 함께 추가한다.

test/validate-env.test.mjs

@@ -75,3 +75,32 @@ test('rejects credentials embedded in repository URLs and mixed auth modes', ()
   assert.ok(errors.some((error) => error.includes('must not embed credentials')));
   assert.ok(errors.some((error) => error.includes('only one Core repository authentication mode')));
 });
+
+test('keeps Web Push disabled by default and validates activation inputs', () => {
+  assert.deepEqual(validateEnvironment({ ...validEnv, WEB_PUSH_ENABLED: 'false' }), []);
+
+  const errors = validateEnvironment({ ...validEnv, WEB_PUSH_ENABLED: 'true' });
+  assert.ok(errors.some((error) => error.includes('WEB_PUSH_VAPID_SUBJECT')));
+  assert.ok(errors.some((error) => error.includes('WEB_PUSH_VAPID_PUBLIC_KEY')));
+  assert.ok(errors.some((error) => error.includes('WEB_PUSH_VAPID_PRIVATE_KEY_FILE')));
+  assert.ok(
+    validateEnvironment({
+      ...validEnv,
+      WEB_PUSH_ENABLED: 'true',
+      WEB_PUSH_VAPID_SUBJECT: 'mailto:admin@test.invalid',
+      WEB_PUSH_VAPID_PUBLIC_KEY: 'test-public-key',
+      WEB_PUSH_VAPID_PRIVATE_KEY_FILE: './secrets/web_push_vapid_private_key.example',
+    }).some((error) => error.includes('WEB_PUSH_VAPID_PRIVATE_KEY_FILE')),
+  );
+
+  assert.deepEqual(
+    validateEnvironment({
+      ...validEnv,
+      WEB_PUSH_ENABLED: 'true',
+      WEB_PUSH_VAPID_SUBJECT: 'mailto:admin@test.invalid',
+      WEB_PUSH_VAPID_PUBLIC_KEY: 'test-public-key',
+      WEB_PUSH_VAPID_PRIVATE_KEY_FILE: './secrets/web-push-private-key',
+    }),
+    [],
+  );
+});